iptable in fc5

list user xktnniuymlla at mailinator.com
Mon May 15 22:12:53 UTC 2006


Hongwei Li wrote:
>>>I don't know if the output of tcpdump -nn helps or not:
>>>...
>>>16:02:40.803697 IP 128.252.85.35.22 > 128.252.85.103.2167: P
>>
>><snip />
>>
>>oooh :(  SSH makes alot of noise.  Not too useful this way.
>>
>>
>>>Here is iptables-save output:
>>>
>>># Generated by iptables-save v1.3.5 on Mon May 15 15:59:18 2006
>>>*filter
>>>:INPUT ACCEPT [0:0]
>>>:FORWARD ACCEPT [0:0]
>>>:OUTPUT ACCEPT [0:0]
>>>:RH-Firewall-1-INPUT - [0:0]
>>>:okay - [0:0]
>>>-A INPUT -j RH-Firewall-1-INPUT
>>>-A FORWARD -j RH-Firewall-1-INPUT
>>>-A OUTPUT -s 127.0.0.1 -j ACCEPT
>>>-A OUTPUT -s 128.252.85.35 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -s 127.0.0.1 -i lo -j ACCEPT
>>>-A RH-Firewall-1-INPUT -s 128.252.85.35 -i lo -j ACCEPT
>>>-A RH-Firewall-1-INPUT -i lo -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
>>>-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
>>>tcp
>>>--dport 21 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
>>>tcp
>>>--dport 22 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
>>>tcp
>>>--dport 25 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
>>>tcp
>>>--dport 80 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m
>>>udp
>>>--dport 137 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m
>>>udp
>>>--dport 139 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p tcp -m state --state
>>>NEW,RELATED,ESTABLISHED -m tcp --dport 2049 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p udp -m state --state
>>>NEW,RELATED,ESTABLISHED -m udp --dport 2049 -j ACCEPT
>>>-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
>>>-A okay -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
>>>-A okay -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
>>>COMMIT
>>># Completed on Mon May 15 15:59:18 2006
>>>
>>>I just added udp for nfs port, but still the same problem.
>>>
>>
>>Ok.  Just looked through your "iptables-save".  There is some
>>duplication but nothing that I can see that is wrong.
>>
>>Since you are hitting the REJECT you are not matching a previous rule.
>> From what I can see, the rules must be failing because
>>   a) source address/mask isn't what is being used;
>>   b) port number is not the one being used.
>>
>>If you use "tcpdump -nn port ! ssh" while you try using nfs you should
>>receive something more useable.
>>
> 
> 
> Here it is:
> 
> # tcpdump -v -nn port ! ssh
> tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
> 16:44:14.724722 IP (tos 0x0, ttl 128, id 673, offset 0, flags [none], proto:
> UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
> PACKET(137): QUERY; REQUEST; BROADCAST
> 16:44:15.474700 IP (tos 0x0, ttl 128, id 708, offset 0, flags [none], proto:
> UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
> PACKET(137): QUERY; REQUEST; BROADCAST
> 16:44:15.657608 IP (tos 0xc0, ttl   2, id 0, offset 0, flags [none], proto:
> UDP (17), length: 48) 128.252.85.250.1985 > 224.0.0.2.1985: HSRPv0-hello 20:
> state=active group=85 addr=128.252.85.254 hellotime=3s holdtime=10s
> priority=110 auth="cisco^@^@^@"
> 16:44:15.673489 IP (tos 0x0, ttl   1, id 17732, offset 0, flags [none], proto:
> IGMP (2), length: 40, options ( RA (148) len 4 )) 128.252.85.91 > 224.0.0.22:
> igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_in, 0 source(s)]
> 16:44:15.903332 802.1d config 8055.00:0d:65:75:74:80.8006 root
> 2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
> 16:44:16.187422 arp who-has 128.252.85.40 tell 128.252.85.189
> 16:44:16.215126 arp who-has 128.252.85.88 tell 128.252.85.189
> 16:44:16.224694 IP (tos 0x0, ttl 128, id 735, offset 0, flags [none], proto:
> UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
> PACKET(137): QUERY; REQUEST; BROADCAST
> 16:44:16.338898 IP (tos 0x0, ttl   1, id 17733, offset 0, flags [none], proto:
> IGMP (2), length: 40, options ( RA (148) len 4 )) 128.252.85.91 > 224.0.0.22:
> igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_in, 0 source(s)]
> 16:44:17.099723 IP (tos 0x0, ttl 128, id 749, offset 0, flags [none], proto:
> UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
> PACKET(137): QUERY; REQUEST; BROADCAST
> 16:44:17.849770 IP (tos 0x0, ttl 128, id 851, offset 0, flags [none], proto:
> UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
> PACKET(137): QUERY; REQUEST; BROADCAST
> 16:44:17.905851 802.1d config 8055.00:0d:65:75:74:80.8006 root
> 2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
> 16:44:18.569998 IP (tos 0xc0, ttl   2, id 0, offset 0, flags [none], proto:
> UDP (17), length: 48) 128.252.85.250.1985 > 224.0.0.2.1985: HSRPv0-hello 20:
> state=active group=85 addr=128.252.85.254 hellotime=3s holdtime=10s
> priority=110 auth="cisco^@^@^@"
> 16:44:18.587619 aarp who-has 85.4.9 tell 85.1.4
> 16:44:18.599725 IP (tos 0x0, ttl 128, id 873, offset 0, flags [none], proto:
> UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
> PACKET(137): QUERY; REQUEST; BROADCAST
> 16:44:19.009393
> 16:44:19.903665 802.1d config 8055.00:0d:65:75:74:80.8006 root
> 2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
> 16:44:20.224157 et1 AT 85.4.9.1 > 0.0.1:  at-rtmp 232
> 16:44:20.225361 IP (tos 0x0, ttl 128, id 19752, offset 0, flags [none], proto:
> UDP (17), length: 78) 128.252.85.66.137 > 128.252.85.255.137: NBT UDP
> PACKET(137): QUERY; REQUEST; BROADCAST
> ...

Sorry, Hongwei, I didn't see any nfs traffic in that log section.

> 
> I want to ask another question -- Why do we need the last line in the file
> iptables:
> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
> 
> If I comment it out, then everything works.

Of course, because then you're no longer "firewalling".  It says, 
"Everybody with tickets stand in this line; everybody else gets in free".

   Will that cause firewall actually
> not functioning?  In fc3,fc4 I don't see similar line in the default firewall
> setting.  Something new in fc5?
> 
> Thanks!
> 
> Hongwei
> 




More information about the fedora-list mailing list